LXR uboot/include/fsl

   1/* SPDX-License-Identifier: GPL-2.0+ */
   2/*
   3 * Copyright 2015 Freescale Semiconductor, Inc.
   4 */
   5
   6#ifndef _FSL_VALIDATE_H_
   7#define _FSL_VALIDATE_H_
   8
   9#include <fsl_sec.h>
  10#include <fsl_sec_mon.h>
  11#include <command.h>
  12#include <linux/types.h>
  13
  14#define WORD_SIZE 4
  15
  16/* Minimum and maximum size of RSA signature length in bits */
  17#define KEY_SIZE       4096
  18#define KEY_SIZE_BYTES (KEY_SIZE/8)
  19#define KEY_SIZE_WORDS (KEY_SIZE_BYTES/(WORD_SIZE))
  20
  21extern struct jobring jr;
  22
  23/* Barker code size in bytes */
  24#define ESBC_BARKER_LEN 4       /* barker code length in ESBC uboot client */
  25                                /* header */
  26
  27/* No-error return values */
  28#define ESBC_VALID_HDR  0       /* header is valid */
  29
  30/* Maximum number of SG entries allowed */
  31#define MAX_SG_ENTRIES  8
  32
  33/* Different Header Struct for LS-CH3 */
  34#ifdef CONFIG_ESBC_HDR_LS
  35struct fsl_secboot_img_hdr {
  36        u8 barker[ESBC_BARKER_LEN];     /* barker code */
  37        u32 srk_tbl_off;
  38        struct {
  39                u8 num_srk;
  40                u8 srk_sel;
  41                u8 reserve;
  42        } len_kr;
  43        u8 ie_flag;
  44
  45        u32 uid_flag;
  46
  47        u32 psign;              /* signature offset */
  48        u32 sign_len;           /* length of the signature in bytes */
  49
  50        u64 pimg64;             /* 64 bit pointer to ESBC Image */
  51        u32 img_size;           /* ESBC client image size in bytes */
  52        u32 ie_key_sel;
  53
  54        u32 fsl_uid_0;
  55        u32 fsl_uid_1;
  56        u32 oem_uid_0;
  57        u32 oem_uid_1;
  58        u32 oem_uid_2;
  59        u32 oem_uid_3;
  60        u32 oem_uid_4;
  61        u32 reserved1[3];
  62};
  63
  64#ifdef CONFIG_KEY_REVOCATION
  65/* Srk table and key revocation check */
  66#define UNREVOCABLE_KEY 8
  67#define ALIGN_REVOC_KEY 7
  68#define MAX_KEY_ENTRIES 8
  69#endif
  70
  71#if defined(CONFIG_FSL_ISBC_KEY_EXT)
  72#define IE_FLAG_MASK 0x1
  73#define SCRATCH_IE_LOW_ADR 13
  74#define SCRATCH_IE_HIGH_ADR 14
  75#endif
  76
  77#else /* CONFIG_ESBC_HDR_LS */
  78
  79/*
  80 * ESBC uboot client header structure.
  81 * The struct contain the following fields
  82 * barker code
  83 * public key offset
  84 * pub key length
  85 * signature offset
  86 * length of the signature
  87 * ptr to SG table
  88 * no of entries in SG table
  89 * esbc ptr
  90 * size of esbc
  91 * esbc entry point
  92 * Scatter gather flag
  93 * UID flag
  94 * FSL UID
  95 * OEM UID
  96 * Here, pub key is modulus concatenated with exponent
  97 * of equal length
  98 */
  99struct fsl_secboot_img_hdr {
 100        u8 barker[ESBC_BARKER_LEN];     /* barker code */
 101        union {
 102                u32 pkey;               /* public key offset */
 103#ifdef CONFIG_KEY_REVOCATION
 104                u32 srk_tbl_off;
 105#endif
 106        };
 107
 108        union {
 109                u32 key_len;            /* pub key length in bytes */
 110#ifdef CONFIG_KEY_REVOCATION
 111                struct {
 112                        u32 srk_table_flag:8;
 113                        u32 srk_sel:8;
 114                        u32 num_srk:16;
 115                } len_kr;
 116#endif
 117        };
 118
 119        u32 psign;              /* signature offset */
 120        u32 sign_len;           /* length of the signature in bytes */
 121        union {
 122                u32 psgtable;   /* ptr to SG table */
 123#ifndef CONFIG_ESBC_ADDR_64BIT
 124                u32 pimg;       /* ptr to ESBC client image */
 125#endif
 126        };
 127        union {
 128                u32 sg_entries; /* no of entries in SG table */
 129                u32 img_size;   /* ESBC client image size in bytes */
 130        };
 131        u32 img_start;          /* ESBC client entry point */
 132        u32 sg_flag;            /* Scatter gather flag */
 133        u32 uid_flag;
 134        u32 fsl_uid_0;
 135        u32 oem_uid_0;
 136        u32 reserved1[2];
 137        u32 fsl_uid_1;
 138        u32 oem_uid_1;
 139        union {
 140                u32 reserved2[2];
 141#ifdef CONFIG_ESBC_ADDR_64BIT
 142                u64 pimg64;     /* 64 bit pointer to ESBC Image */
 143#endif
 144        };
 145        u32 ie_flag;
 146        u32 ie_key_sel;
 147};
 148
 149#ifdef CONFIG_KEY_REVOCATION
 150/* Srk table and key revocation check */
 151#define SRK_FLAG        0x01
 152#define UNREVOCABLE_KEY 4
 153#define ALIGN_REVOC_KEY 3
 154#define MAX_KEY_ENTRIES 4
 155#endif
 156
 157#if defined(CONFIG_FSL_ISBC_KEY_EXT)
 158#define IE_FLAG_MASK 0xFFFFFFFF
 159#endif
 160
 161#endif /* CONFIG_ESBC_HDR_LS */
 162
 163
 164#if defined(CONFIG_FSL_ISBC_KEY_EXT)
 165struct ie_key_table {
 166        u32 key_len;
 167        u8 pkey[2 * KEY_SIZE_BYTES];
 168};
 169
 170struct ie_key_info {
 171        uint32_t key_revok;
 172        uint32_t num_keys;
 173        struct ie_key_table ie_key_tbl[32];
 174};
 175#endif
 176
 177#ifdef CONFIG_KEY_REVOCATION
 178struct srk_table {
 179        u32 key_len;
 180        u8 pkey[2 * KEY_SIZE_BYTES];
 181};
 182#endif
 183
 184/*
 185 * SG table.
 186 */
 187#if defined(CONFIG_FSL_TRUST_ARCH_v1) && defined(CONFIG_FSL_CORENET)
 188/*
 189 * This struct contains the following fields
 190 * length of the segment
 191 * source address
 192 */
 193struct fsl_secboot_sg_table {
 194        u32 len;                /* length of the segment in bytes */
 195        u32 src_addr;           /* ptr to the data segment */
 196};
 197#else
 198/*
 199 * This struct contains the following fields
 200 * length of the segment
 201 * Destination Target ID
 202 * source address
 203 * destination address
 204 */
 205struct fsl_secboot_sg_table {
 206        u32 len;
 207        u32 trgt_id;
 208        u32 src_addr;
 209        u32 dst_addr;
 210};
 211#endif
 212
 213/* ESBC global structure.
 214 * Data to be used across verification of different images.
 215 * Stores follwoing Data:
 216 * IE Table
 217 */
 218struct fsl_secboot_glb {
 219#if defined(CONFIG_FSL_ISBC_KEY_EXT)
 220        uintptr_t ie_addr;
 221        struct ie_key_info ie_tbl;
 222#endif
 223};
 224/*
 225 * ESBC private structure.
 226 * Private structure used by ESBC to store following fields
 227 * ESBC client key
 228 * ESBC client key hash
 229 * ESBC client Signature
 230 * Encoded hash recovered from signature
 231 * Encoded hash of ESBC client header plus ESBC client image
 232 */
 233struct fsl_secboot_img_priv {
 234        uint32_t hdr_location;
 235        uintptr_t ie_addr;
 236        u32 key_len;
 237        struct fsl_secboot_img_hdr hdr;
 238
 239        u8 img_key[2 * KEY_SIZE_BYTES]; /* ESBC client key */
 240        u8 img_key_hash[32];    /* ESBC client key hash */
 241
 242#ifdef CONFIG_KEY_REVOCATION
 243        struct srk_table srk_tbl[MAX_KEY_ENTRIES];
 244#endif
 245        u8 img_sign[KEY_SIZE_BYTES];            /* ESBC client signature */
 246
 247        u8 img_encoded_hash[KEY_SIZE_BYTES];    /* EM wrt RSA PKCSv1.5  */
 248                                                /* Includes hash recovered after
 249                                                 * signature verification
 250                                                 */
 251
 252        u8 img_encoded_hash_second[KEY_SIZE_BYTES];/* EM' wrt RSA PKCSv1.5 */
 253                                                /* Includes hash of
 254                                                 * ESBC client header plus
 255                                                 * ESBC client image
 256                                                 */
 257
 258        struct fsl_secboot_sg_table sgtbl[MAX_SG_ENTRIES];      /* SG table */
 259        uintptr_t ehdrloc;      /* ESBC Header location */
 260        uintptr_t *img_addr_ptr;        /* ESBC Image Location */
 261        uint32_t img_size;      /* ESBC Image Size */
 262};
 263
 264int do_esbc_halt(cmd_tbl_t *cmdtp, int flag, int argc,
 265                                char * const argv[]);
 266
 267int fsl_secboot_validate(uintptr_t haddr, char *arg_hash_str,
 268        uintptr_t *img_addr_ptr);
 269int fsl_secboot_blob_encap(cmd_tbl_t *cmdtp, int flag, int argc,
 270        char * const argv[]);
 271int fsl_secboot_blob_decap(cmd_tbl_t *cmdtp, int flag, int argc,
 272        char * const argv[]);
 273
 274int fsl_check_boot_mode_secure(void);
 275int fsl_setenv_chain_of_trust(void);
 276
 277/*
 278 * This function is used to validate the main U-boot binary from
 279 * SPL just before passing control to it using QorIQ Trust
 280 * Architecture header (appended to U-boot image).
 281 */
 282void spl_validate_uboot(uint32_t hdr_addr, uintptr_t img_addr);
 283#endif
 284